16.8 Post-Upgrade Task

Perform the following action after upgrade:

NOTE:After upgrading identity application and identity reporting, restore the appropriate jars used during installation either ojdbc8.jar for Oracle or mssql-jdbc-9.2.1.jre8.jar for MSSQL to the tomcat/lib directory, based on the database in use. Then, restart the tomcat services.

16.8.1 Configuring TLSv1.3 for Tomcat Services

Perform the following steps to configure TLSv1.3:

  1. Navigate to C:\NetIQ\IDM\apps\tomcat\conf directory and add the following entries to server.xml file.

    useServerCipherSuitesOrder="true"
    ciphers="TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
    sslEnabledProtocols="TLSv1.2+TLSv1.3"

    For example:

    <Connector port="8543" protocol="HTTP/1.1" URIEncoding="UTF-8" maxThreads="200" enableLookups="true" scheme="https" secure="true" maxHttpHeaderSize="65536" SSLEnabled="true" sslProtocol="TLS" disableUploadTimeout="true" keystoreFile="conf/tomcat.ks" keystorePass="novell" useServerCipherSuitesOrder="true" ciphers="TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" sslEnabledProtocols="TLSv1.2+TLSv1.3" />

  2. Open the ism-configuration.properties file and edit the following entry that is change TLSv1.2 to TLSv1.3:

    com.netiq.idm.sslProtocol = TLSv1.3

  3. Restart the tomcat services.

NOTE:In the OpenText Identity Manager environment, if there is a mismatch in SSPR and Tomcat TLS configuration, then regardless of whether the SSPR TLS configuration is set to 1.2, Tomcat TLS configuration takes the precedence, which is set to 1.3 in ism-configuration.properties.